Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
zendframework/zendxml
master @ ce31942
5
Fixes
0
CVEs
HIGH
Peak severity
Highlights
XXE: 4 prior fixes. Scrutinize any change in this area.
ZendXml\Security: most-fixed (2 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
XXE: Attackers can bypass heuristic scans by encoding XML payloads in multibyte formats (such as UTF-16 or UTF-32) that standard ASCII/UTF-8 string matching fails to detect, leading to arbitrary local file disclosure or SSRF.
XXE: Environment-specific edge cases, such as faulty PHP version comparisons under PHP-FPM, can silently disable runtime defenses like libxml_disable_entity_loader, leaving the XML parser fully exposed to external entity loading.
XML External Entity (XXE): Failing to safely restore libxml state variables in try-finally blocks or during early-return failure paths can leave subsequent XML parsing operations in the same thread context vulnerable to XXE injections.